diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml
index 07ff46f..ca863b9 100644
--- a/registry/routing/catalog.yaml
+++ b/registry/routing/catalog.yaml
@@ -287,9 +287,17 @@ entries:
     warden_executes: false
     wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
     canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
-    reviewed: "2026-07-12"
-    status: draft
-    # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval.
+    reviewed: "2026-07-13"
+    status: active
+    resolvable: true
+    # CCR-2026-0006: approved by platform-operator 2026-07-12; policy
+    # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on
+    # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at
+    # platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented
+    # fetch_command returns non-empty, PAT valid against forgejo.coulomb.social
+    # (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial
+    # recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is
+    # workstation/worker OIDC fetch only, no cluster ExternalSecret.
     auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
     path_template: "platform/workloads/forgejo/forgejo-admin"
     fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"
diff --git a/wiki/playbooks/forgejo-admin-api-token.md b/wiki/playbooks/forgejo-admin-api-token.md
index daddf1f..01d4f9c 100644
--- a/wiki/playbooks/forgejo-admin-api-token.md
+++ b/wiki/playbooks/forgejo-admin-api-token.md
@@ -1,7 +1,7 @@
 # Forgejo Admin API Token (PAT)
 
-Date: 2026-07-12  
-Catalog: `forgejo-admin-api-token` (status `draft`, `resolvable: false` until verified)  
+Date: 2026-07-12 (verified 2026-07-13)  
+Catalog: `forgejo-admin-api-token` (status `active`, `resolvable: true`)  
 Owner: `railiance-platform` (CCR-2026-0006)
 
 Forgejo site-admin personal access token for operator and automation tooling.
@@ -45,7 +45,7 @@ worker fetch only — no cluster ExternalSecret delivery.
    )
    ```
 
-3. **Or proxy via warden access** (after catalog promotion):
+3. **Or proxy via warden access** (catalog lane is `active`):
 
    ```bash
    warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN
diff --git a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
index 0de3dc0..9a95c00 100644
--- a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
+++ b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
@@ -74,16 +74,20 @@ state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
 
 ```task
 id: WARDEN-WP-0025-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
 ```
 
-- [ ] Mint PAT as Forgejo user `tegwick` (attended)
-- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin`
-- [ ] Positive fetch after OIDC login
+- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12)
+- [x] Stored at `platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN`
+      (initial provision used field `Token`; re-stored as `API_TOKEN` 2026-07-13 to
+      match CCR/catalog/playbook `fetch_command`)
+- [x] Positive fetch verified 2026-07-13 — `bao kv get -field=API_TOKEN …` returns
+      non-empty; PAT valid against `forgejo.coulomb.social` (`/api/v1/user` →
+      `login=tegwick`, `is_admin=true`)
 - [x] Negative default-policy denial recorded on CCR
-- [ ] Promote catalog to `active` after positive verify
+- [x] Promoted catalog `forgejo-admin-api-token` to `active` (`resolvable: true`)
 
 ### T5 — Notify downstream consumers